Five Eyes warns on AI threats, Mustang Panda strikes India

The Five Eyes alliance issued an urgent warning that frontier AI will transform cyber capabilities in months, not years. Meanwhile, Mustang Panda is abusing Zoho WorkDrive to target Indian government networks, and a critical Oracle EBS flaw is being actively exploited. The day's stories share a thread: adversaries are moving fast, and defenders need to match that pace.

Sources

Allied warnings and AI threats

The Five Eyes intelligence alliance issued a coordinated statement that sets the tone for the day: AI-driven cyber threats are accelerating faster than expected.

#01www.jdsupra.comJun 30

Five Eyes Issues Urgent Call to Action on AI-Driven Cyber Threats | JD Supra

The Five Eyes statement is notable for its urgency: it says frontier AI will reshape offensive and defensive cyber capabilities on a timeline of months, not years. This is a rare joint call to action from the alliance's cybersecurity agencies.

2 min readRead original

#02www.helpnetsecurity.comJun 30

Mozilla warns of indirect prompt injection risk in AI coding agents

Mozilla's 0DIN team demonstrated a practical indirect prompt injection attack on AI coding agents like Claude Code, using a GitHub README to trigger a reverse shell. It's a concrete example of the kind of AI-driven threat the Five Eyes is warning about.

2 min readRead original

Active campaigns and exploits

While policymakers warn of future threats, attackers are already active today, Mustang Panda is abusing legitimate cloud services, and a critical Oracle EBS flaw is being exploited in the wild.

#03www.hendryadrian.comJun 30

Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

Mustang Panda is using Zoho WorkDrive as a covert C2 channel, hiding malicious traffic inside legitimate cloud activity makes detection harder. The group is targeting Indian government and hydropower organizations with spear-phishing and sideloading.

#04briefly.coJun 30

Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild

CVE-2026-46817 is a critical Oracle E-Business Suite flaw (CVSS 9.8) being actively exploited in the wild. Oracle patched it in the latest CPU, but Defused Cyber observed exploitation on honeypots, meaning unpatched systems are at immediate risk.